#275 feat(mcp): exclusions baseline flag and opt-in agent control

[Anonymous]

Originally created by: Avazbek22

Implements [#267] on top of the v5.2 branch, hardened through adversarial and live behavioral QA, including real-process stdio sessions.

Feature

• devprojex mcp --exclude <NAME>... sets the server's baseline exclusion set with the same tokens the CLI and TUI speak; none disables all toggles; full set-replacement semantics. Like --git-mode, the baseline yields to an explicit per-call profile.
• devprojex mcp --unrestricted is the widest-baseline preset: every exclusion toggle off plus Git baseline none (equivalent to --exclude none --git-mode none, rejected in combination with either flag). Secret redaction still applies. The .git administrative area stays excluded in every mode — the boundary now holds engine-wide even with Git filtering off.
• devprojex mcp --allow-agent-exclusions (opt-in) publishes an exclusions array parameter on the five selection tools — get_tree, analyze, pack_context, search_project, and get_file — carrying the full desired toggle set; [] means all off; the per-call value outranks the server baseline and profile exclusions. Without the flag the parameter does not exist in any schema and is rejected by the argument allowlist.
• analyze results echo the effective exclusion tokens (additive required field — consumers pinning the old output schema must refresh it).

Security posture (adversarially verified)

• Red line holds: hide-secrets/hide-private-data are absent from every schema in every spelling, rejected at CLI parse, at host validation, and at tool-argument parse; HideSecrets: true is forced in the selection spec and again in the transformation context.
• Root jail holds: widening visibility cannot escape ValidatePlanContainment — a dot-folder symlinking outside the jail fails closed.
• Argument hygiene: per-item length cap, duplicate rejection (schema declares uniqueItems), case-insensitive tokens documented in the schema description.

QA-driven fixes

• get_file joined the delegation so files revealed by a per-call set stay readable through the same set (the audit's only coherence defect).
• Undocumented -x alias removed from mcp --exclude; empty-allowlist errors now say "This tool takes no arguments."; get_file not-found guidance no longer suggests impossible recovery steps.
• Localization polish: doubled "repeatable" marker removed from the new option in all 20 locales; the Japanese auto-appended repeatable suffix mistranslation fixed.
• Docs: platform semantics of hidden-* toggles, scan-amplification caveat, output-schema compatibility note, token-order alignment.

Additional v5.2 behavior

• Behavior change: the default MCP exclusion baseline is now smart-ignore plus empty-folders, rather than the desktop standard set. To restore the previous view, start the server with devprojex mcp --exclude smart-ignore --exclude empty-folders --exclude empty-files --exclude hidden-folders --exclude hidden-files --exclude dot-folders --exclude dot-files --exclude extensionless-files.
• The MCP-only default token expands to the default exclusion set, allowing explicit extensions such as --exclude default --exclude dot-folders.
• get_tree and pack_context append a trusted [Effective filters] footer. list_projects.baseline is a required output field and exposes the active Git baseline, exclusion set, and whether per-call exclusions are enabled.
• Empty selections and searches now return explicit [Empty selection] and [No matches] diagnostics instead of ambiguous empty payloads.
• Glob braces such as {cs,fs} expand into alternatives. Negation with ! and character classes with [...] are rejected explicitly instead of being interpreted as literals.

MCP response hardening

• Wrong-case file paths produce the same diagnostic on every platform and name the exact spelling listed by get_tree.
• get_file.path and paths in analyze and pack_context accept backslash-escaped ASCII punctuation copied from the default Markdown tree. format: "text" remains the unescaped copy path.
• [Empty selection] diagnostics now distinguish path-only requests, pattern requests, Git scopes, and baseline-filter exhaustion.
• Token-budget guidance appears only when at least one file was skipped.
• Continuation and truncation trailers are trusted text outside the untrusted-data block, so paging instructions remain actionable.
• An explicit max_file_bytes value is included in effective-filter diagnostics across every tool that accepts it.
• Tool descriptions now define redaction placeholders and allowlisted example values, the inline/stored pack threshold and view/format, working-tree semantics for git_scope, and standard/local profile behavior. Stored-pack headers include both character and line counts; unknown profiles return DPX-MCP-INVALID-ARGUMENTS; MCP messages no longer expose internal DPX-CLI-* codes.

[Anonymous]

Ticket changed by: Avazbek22

• status: open --> closed